What they found
The authors built MemoryDojo, a benchmark that tracks how poisoned information moves through an SI agent's memory and how it changes the agent's later behavior. It has 155 multi-session, long-horizon trajectories across four domains and supports five memory systems. In their tests, all memory systems were open to memory poisoning, and the downstream effects varied a lot between systems. The authors also propose a memory-aware way to optimize the poison, which makes the attack work better and shows differences between memory designs. The abstract gives no specific success rates, so the size of the effects is not stated here.
Why it matters
SI agents increasingly use memory to handle long tasks that span many sessions. This paper points out that memory can carry a malicious instruction from one session into a later one, where the agent may act on it. A shared way to measure this lets teams compare memory designs on risk, not only on performance. The benchmark is described as easy to extend, so others can add systems and cases.
How it changes the race
This is mostly a measurement tool, not a capability gain. It could push builders of agent memory to treat security as a design factor, since the abstract says memory designs differ in how exposed they are.
Safety and control
The paper bears directly on security. It reports that all tested memory systems are susceptible to poisoning, and that an optimized attack makes it more effective. The authors hope the benchmark will support research on defenses, but the abstract does not describe any defense.
The abstract, by the authors
LLM agents benefit from using memory systems to improve performance on long-horizon, multi-session tasks. However, memory introduces a critical attack surface. Malicious instructions encountered in one session may be stored and propagated through memory before being retrieved and acted upon in later sessions. Because memory systems differ in how they process and retrieve information, the downstream effects of poisoning can vary significantly across systems. To quantify the effects of poisoning across different memory architectures, we introduce MemoryDojo, a benchmark for tracing the lifecycle of poisoned information through agent memory and measuring its influence on subsequent agent behavior. MemoryDojo is easily extensible, consists of 155 multi-session long-horizon trajectories covering four domains, and supports five different memory systems. Through our evaluation, we find that all memory systems are susceptible to memory poisoning, with substantial variation in downstream effects. We further propose a memory-aware poison optimization process that increases the poisoning efficacy, highlighting differences between memory architectures. We hope that MemoryDojo will support research on understanding and mitigating agentic memory risks.
Quoted from arXiv:2611.09721. The research and its words belong to its authors.